Hacker News Reader

Here is the list of permission the extension requires:

- Access your data for all web sites

If even the browser vendor can't do better than requesting access to everything I'm not surprised that we end up with extensions being sold and abused (for their permissions).

View on HN

(Relay tech lead here)

Yeah, the all_urls add-ons are always concerning. We have an issue filed to move that to optional_permissions instead, but need to get the UX right:

https://github.com/mozilla/fx-private-relay/issues/252

I would like to see these extensions only activating when I click them on toolbar.

Most extensions I could consider are only needed for few pages.

As a developer, I can say that this is maybe possible, but not easy. Because so many things have to be hardcoded in the manifest, the code and UK gets complicated and messy quickly if you try to workaround to provide both ways.

Reply on news.ycombinator.com